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Application/Control Number: 09/734,952 Page 
Art Unit: 2154 

DETAILED ACTION 

1. Claims 1-45 are subject to examination. Claims 1, 10-12, 21-23, 32-35. 44 
and 45 have been canceiled. 

Response to Arguments 

2. Applicant's arguments filed 05/05/2005 have been fully considered but 
they are not persuasive for the following reasons: 

Applicant's argument: 

"The Examiner does not provide a specific reference to support the above 
statements, and support for the statements cannot be found in Lin et al. To the 
extent the Examiner applies the above statements to the 35 U.S.C. § 102 
rejections, the Applicants respectfully submit such a rejection is improper, as 
each and every element as set forth in the claims are not found, either expressly 
or inherently described, in a single prior art reference. Furthermore, to the extent 
the Examiner applies the same statements to the 35 U.S.C. j 103 rejections, the 
Applicants assume that the Examiner intended to take Official notice of facts 
under M.P.E.P. 2144.03 that the rationale supporting the obviousness rejection is 
based on common knowledge in the art or "well- known" prior art. Under 
M.P.E.P. 2144.03, "[I] if the applicant traverses such an assertion the examiner 
should cite a reference in support of his or her position." The Applicants hereby 
traverse the assertion and request that a reference be cited in support of the 
position outlined in the Office Action." 
Examiner's response: 
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Please refer to col. 5, line 37 through col. 6, line 55, Blumer et al. (US 6, 
189, 019 B1) for the cited well known prior art and the state of the Internet 
connmunications using HTTP message protocol and underlying transmission 
control protocol/internet protocol (TCP/IP) data transport protocol of the internet. 

The discussion of the state the well known prior art was warranted to show 
inherency that is built in the reference Lin because of the previously presented 
argument stating "Since Lin fails to consider GETS, POSTS, or connected 
subscribers, the reference can not be said to anticipate the current claims. 
Further, without Lin the other cited references fail to render the current claims 
obvious." 

In addition Lin, also teaches in col. 2, line 1-6, "FIG. 1 illustrates an aspect 
of the invention in a broad form. Referring to FIG. 1, a source 102 initiates a 
session establishment request (e.g., a TCP SYN packet; a new UDP or ICMP 
packet) to a target 1 04." 

Examiner would also like to present the reference Srinivas (US 6, 823, 
387 B1) to further expand the well known prior art that Lin has inherently 
disclosed. Please also refer to the Fig.3 and col. 8, line 63 through col. 9, line 9 
of the reference Srinivas (US 6, 823, 387 B1 ) for a TCP SYN packet involving the 
"legitimate request" wherein " In prior systems, the route information was cached 
at the time the TCP/IP layer 506 would send the SYN-ACK 514 to the client 500. 
This route information would form a cache chain with each of these route entries. 
Of course, if the TCP SYN packet had a spoofed IP address, the caching of the 
route information for this spoofed client served only to make the route cache 
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larger (the chain longer) and more time consuming to processes. To service a 
legitimate client, the cache chain must be searched to find that client's route 
information." Thus in order service a legitimate client (subscriber) to determine 
the "legitimate session requests" the cache chain must be searched to find that 
client's route information, (receiving a profile for said subscriber). 
Claim 2 

Applicant's argument: 

"The Applicants respectfully disagree. Contrary to the Examiner's 
statement, Lin et al, does not teach receiving a HTTP request from a subscriber 
having an establislied connection over a first communication network coupled to 
at least one other communication network, said request including a Universal 
Resource Locator (URL). It is noted that the Examiner's statement fails to include 
the "having an established connection" limitation recited in Claim 2. Additionally, 
nowhere does Lin et al. refer to a "subscriber" let alone a subscriber having an 
established connection as recited in Claim 2." 

"The Applicants respectfully disagree. The passage cited by the Examiner 
speaks generally about allowing a number of legitimate session requests to get 
through to a target. The passage provides no support for the Examiner's 
conclusion regarding existing sessions. Furthermore, the Examiner's 
parenthetical reference to a "profile" finds no support in Lin et al." 
Examiner's response: 

Lin clearly discloses in col. 2, line 15-16, "The filter 106 records the total 
number of existing sessions and measures the rate of session requests of each 



Application/Control Number: 09/734,952 Page 5 

Art Unit: 2154 

stream." Thus Lin include the "having an established connection" limitation 
recited in Claim 2. 

Please refer to the response above for ''from a subscriber having an 
established connection." 
Applicant's Argument: 

"Also contrary to the Examiner's statement, Lin et al. does not teach 
filtering said request to determine whether said subscriber is authorized to make 
said request based upon said profile. As discussed above, Lin et al. teaches 
neither a subscriber having an established connection, nor a profile for the 
subscriber." 

Examiner's response: 

Please refer to the above responses which evidently explains the 
teachings of Lin including filtering said request to determine whether said 
subscriber is authorized to make said request based upon said profile. 
Applicant's argument: 

"Also contrary to the Examiner's statement, Lin et al. does not teach 
updating a client HTTP request count when said request for said URL is a HTTP 
GET request or a HTTP POST request. Nowhere does Lin et al. refer to a HTTP 
GET request or a HTTP POST request. Rather, Lin et al. teaches a session 
request may be a TCP SYN packet, or a new UDP or ICMP packet." 
Examiner's response: 

Lin cleariy discloses in col. 2, line 15-16, "The filter 106 records the total 
number of existing sessions and measures the rate of session requests of 
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each stream." Thus Lin include the "having an established connection" limitation 
recited in Claim 2. 

And the inherency of Lin including the session request over TCP is 
evidently presented by Blumer et al. (US 6, 189, 019 B1) in col. 5, line 37 through 
col. 6, line 55, as well known state of the Internet communications using HTTP 
message protocol and underlying transmission control protocol/Internet protocol 
(TCP/IP) data transport protocol of the internet. 
Applicant's argument: 

"Thus, Lin et al. cannot be said to teach forwarding said request to said at 
least one other communication network when said subscriber is authorized to 
make said request." 
Examiner's response: 

As previously indicated, Lin teaches in col. 2, line 19-21," A source could 
be a single host, a group of hosts in a network or domain, or any number of hosts 
in the entire Internet. By the same token, a target could involve one or more 
hosts and servers in an internal network. " 
Claim 5 

Applicant's argument: 

"The Applicants respectfully disagree. Again, Li et al. speaks generally 
about limiting session establishment packets, but says nothing of HTTP requests. 
Thus, the Identical invention is not shown in Li et al. in as complete detail as is 
contained in the claim." 
Examiner's response: 
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Please refer to above responses explaining the inherency of Lin including the 
session request over TCP is evidently presented by Blumer et al. (US 6, 189, 019 
B1) in col. 5, line 37 through col. 6, line 55, as well known state of the Internet 
communications using HTTP message protocol and underlying transmission 
control protocol/Internet protocol (TCP/IP) data transport protocol of the internet. 

Independent Claims 13 and 24 and Dependent Claims 16 and 27 
Applicant's argument: 

"Claim 13 'is an In re Beauregard claim corresponding to method claim 2, 
Claim 24 is a means-plus-function claim corresponding to method claim 2. Claim 
2 being allowable, Claims 13 and 24 must be allowable for at least the same 
reasons." 

"Claim 16 depends from Claim 13 and is an In re Beauregard claim 
corresponding to method claim 5. Claim 27 depends from Claim 24 and is a 
means-plus-function claim corresponding to method claim 5. Claims 13 and 24 
being allowable, Claims 16 and 27 must be allowable for at least the same 
reasons." 

Examiner's response: 

Please refer to the responses for claims 2 and 5. 
Claims 3, 4, 6,7,8 and 9 
Applicant's argument: 

"The Examiner has not indicated a suggestion or motivation to combine 
the reference teachings. For this additional reason, no prima facie case of 
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obviousness has been established and the 35 U.S.C. § 103 rejection of Claim 3 
should be withdrawn." 
Examiner's response: 

The reference Primeaux teaches the action taken could be defined to suspend 
the user account or merely mail a message to the system administrator (sending 
alarm to an Internet Service Provider (ISP) associated with subscriber), warning 
of a potential ! ntruder including the category of users such as Yes-definitely the 
appropriate user, No--definitely an intruder and Yes/No--may or may not be the 
appropriate user, (col. 10, lines 50-59). Therefore, it would have been obvious to 
one having ordinary skill in the art at the time of invention was made to combine 
Lin*s capabilities with Primeaux's usage pattern tracking capabilities and applying 
the attack preventive measures based on the set threshold levels such as client 
HTTP request frequency exceeding a maximum HTTP request frequency and 
setting an alarm to the ISP (the system administrator). 
Claims 14-15 and 17-20 and Claims 25-26 and 28-31 
Applicant's argument: 

"Claims 14-15 and 17-20 are In re Beauregard claims corresponding to 
method claims 3-4 and 6-9, respectively. Claims 3-4 and 6-9 being allowable, 
Claims 14-15 and 17-20 must be allowable for at least the same reasons. Claims 
25-26 and 28-31 are means-plus-function claims corresponding to method claims 
3-4 and 6-9, respectively. Claims 3-4 and 6-9 being allowable, Claims 25-26 and 
38-31 must be allowable for at least the same reasons." 
Examiner's response: 
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Please refer to the response above for claims 3, 4, 6,7,8 and 9. 
Claims 36-43 
Applicant's argument: 

"The Examiner has not indicated a suggestion or motivation to combine 
the reference teachings. For this additional reason, no prima facie case of 
obviousness has been established and the 35 U.S.C. §103 rejection of Claim 36 
should be withdrawn." 
Examiner's response: 

The reference Prabandham teaches an authorizer capable of allowing 
said request said request to be forwarded on at least one other communication 
network coupled to said first communication network. (Fig. 2, element 216 and 
col.4, line 67 and col. 5, lines 1-8); a first fonA/arding interface capable of sending 
said profile request to an AAA server; (element 212 which has the first receiving 
interface which is AAA server); a second receiving inter-face capable of 
accepting a requested profile; and a second forwarding interface capable of 
forwarding said request on said at least one other communication network, 
(element 216*s interfaces connected to element 212 and element 206). 
Therefore, it would have been obvious to one having ordinary skill in the art at 
the time of invention was made to combine Lin with Primeaux's usage pattern 
tracking capabilities and Prabandham's security protocols. In this way, it will 
provide an alternative to the Lin's system for an user AAA verification, in addition 
to filter's capability to selectively passing some of the session establishment 
requests. 
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Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 
U.S.C. 102 that form the basis for the rejections under this section made in this 
Office action: 

A person shall be entrtled to a patent unless- 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
the invention by the applicant for patent, except that an International application filed under 
the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

4. Claims 2, 5, 13, 16, 24 and 27 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Lin et al. (hereinafter Lin)(US 6,751, 668), 

Referring to claim 2, 

The reference teaches a method for preventing denial of service attacks (col.l , 
lines 7-10) against Hypertext Transfer Protocol (HTTP) servers (coL2, lines 17- 
25) the method comprising: 

receiving a HTTP request from a subscriber using a first communication 
network coupled to at least one other communication network, said request 
including a Universal Resource Locator (URL), (col.2, lines 21-25) 

receiving a profile for said subscriber; filtering said request to determine 
whether said subscriber is authorized to make said request based upon said 
profile, (col.2, lines 63-66, col.4, lines 14-18) said filtering including: 

updating a client HTTP request count when said request is a HTTP "GET' 



Application/Control Number: 09/734,952 Page 1 1 

Art Unit: 2154 

request or a HTTP "POST' request; and applying HTTP server denial of service 
attack preventative measures when a client HTTP request frequency based on 
said client HTTP request count exceeds a maximum HTTP request frequency 
and forwarding said request to said at least one other communication network 
when said subscriber is authorized to make said request. (coL2, lines 26-62, 
coL4, lines 14-18). 
Referring to claim 5, 

The reference teaches the method wherein said applying further comprises 
dropping 

the data packet containing said request when said client HTTP request frequency 
exceeds said maximum HTTP request frequency, (col.2, lines 33-39, lines 63- 
66). 

Referring to claim 13, 

Claim 13 is a claim to a program storage device readable by a machine, 
embodying a program of instructions executable by the machine to perform the 
steps of method of claim 2. Therefore, claim 13 is rejected for the reasons set 
forth for the claim 2. 
Referring to claim 16, 

Claim 16 is a claim to a program storage device readable by a machine, 
embodying a program of instructions executable by the machine to perform the 
steps of method of claim 5. Therefore, claim 16 is rejected for the reasons set 
forth for the claim 5. 
Referring to claim 24, 
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Claim 24 is a claim to an apparatus carrying out the method of claim 2. 
Therefore, claim 24 is rejected for the reasons set forth for the claim 2. 
Referring to claim 27, 

Claim 27 is a claim to an apparatus carrying out the method of claim 5. 
Therefore, claim 27 is rejected for the reasons set forth for the claim 5. 

Claim Rejections - 35 USC § 103 

5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for 
all obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth in section 102 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

6. Claims 3, 4, 6, 14, 15, 17-20, 25, 26 and 29-31 are rejected under 35 
U.S.C. 103(a) as being unpatentable over Lin et al. (hereinafter Lin)(US 6,751, 
668) in view of Primeaux et al. (hereinafter Primeaux) (US 6,334,121 ). 
Referring to claims 3 and 4, 

Keeping in mind the teachings of the reference Lin as stated above, the 
reference fails to teach setting an alarm when said client HTTP request 
frequency exceeds said maximum HTTP request frequency and sending said 
alarm to an Internet Service Provider (ISP) associated with subscriber. The 
reference Primeaux teaches the action taken could be defined to suspend the 
user account or merely mail a message to the system administrator (sending 
alarm to an Internet Service Provider (ISP) associated with subscriber), warning 
of a potential intruder including the category of users such as Yes-definitely the 
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appropriate user, No--definitely an intruder and Yes/No--nnay or may not be the 
appropriate user. (col. 10, lines 50-59). The reference also teaches that if the 
usage pattern is outside of the user's normal usage pattern, this triggers the 
system to react automatically. The reaction of the system is adjustable and will 
depend primarily on the nature and the degree of destructiveness of a particular 
command and the level of security awareness that the software is set for 
(dropping the data packet containing request). Various levels of security are 
determined by the list of commands deemed critical by the system administrator, 
(col. 10, lines 60-67). Therefore, it would have been obvious to one having 
ordinary skill in the art at the time of invention was made to combine Lin's 
capabilities with Primeaux's usage pattern tracking capabilities and applying the 
attack preventive measures based on the set threshold levels such as client 
HTTP request frequency exceeding a maximum HTTP request frequency and 
setting an alarm to the ISP (the system administrator). 
Referring to claims 6, 7, 8 and 9, 

Keeping in mind the teachings of Lin as stated above, although the reference 
teaches disabling HTTP requests for a hold-down period when said client HTTP 
request frequency exceeds said maximum HTTP request frequency. (Fig. 4, 
"shaded area"), the reference fails to teach shutting down the account used to 
access first communication network when said client HTTP request frequency 
exceeds said maximum HTTP request frequency and increasing said hold-down 
period each time said client HTTP request frequency exceeds said maximum 
HTTP request frequency, and wherein said hold-down period increases 
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exponentially each time said client HTTP request frequency exceeds said 
maximum HTTP request frequency. The reference Primeaux teaches the action 
taken could be defined to suspend the user account (shutting down the account 
used to access and disabling HTTP requests for a hold-down period) or merely 
mail a message to the system administrator, warning of a potential intruder 
including the category of users such as Yes--definitely the appropriate user, No- 
definitely an intruder and Yes/No--may or may not be the appropriate user. (col. 
10, lines 50-59). The reference also teaches that if the usage pattern is outside of 
the user's normal usage pattern, this triggers the system to react automatically. 
The reaction of the system is adjustable and will depend primarily on the nature 
and the degree of destructiveness of a particular command and the level of 
security awareness that the software is set for (hold-down period each time client 
HTTP request frequency exceeds said maximum HTTP request frequency and 
hold-down period increases exponentially each time client HTTP request 
frequency exceeds maximum HTTP request frequency). Various levels of 
security are determined by the list of commands deemed critical by the system 
administrator, (col. 10, lines 60-67). Therefore, it would have been obvious to one 
having ordinary skill in the art at the time of invention was made to combine Lin 
with Primeaux's usage pattern tracking capabilities based on the normal 
commands such as a HTTP "GET" request or a HTTP "POST" request; and 
applying the attack preventive measures based on the set threshold levels such 
as client HTTP request frequency exceeding a maximum HTTP request 
frequency set by the security rules and to suspend the user account (shutting 
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down the account used to access and disabling HTTP requests for a hold-down 
period) as desired, based on the level of security awareness that the software is 
set for (hold-down period each time client HTTP request frequency exceeds said 
maximum HTTP request frequency and hold-down period increases 
exponentially each time HTTP frequency exceeds maximum HTTP request 
frequency) when client HTTP request frequency exceeds a maximum HTTP 
frequency. This provides a system wherein the system will detect a difference in 
the pattern of usage. When such a difference is detected, the system will take 
the appropriate action. 
Referring to claims 14'and 15, 

Claims 14 and 15 are claims to a program storage device readable by a 
machine, embodying a program of instructions executable by the machine to 
perform the steps of method of claims 3 and 4. Therefore, claims 14 and 15 are 
rejected for the reasons set forth for the claims 3 and 4. 
Referring to claims 17, 18, 19 and 20, 

Claims 17, . 18, 19 and 20 are claims to a program storage device readable by a 
machine, embodying a program of instructions executable by the machine to 
perform the steps of method of claims 6, 7, 8 and 9. Therefore, claims 17, 18, 19 
and 20 are rejected for the reasons set forth for the claims 6, 7, 8 and 9. 
Referring to claims 25 and 26, 

Claims 25 and 26 are claims to an apparatus carrying out the method of claims 3 
and 4. Therefore, claims 25 and 26 are rejected for the reasons set forth for the 
claims 3 and 4. 
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Referring to claims 28, 29, 30 and 31, 

Claims 28, 29, 30 and 31 are claims to an apparatus carrying out the method of 
claims 6, 7, 8 and 9. Therefore, claims 28, 29, 30 and 31 are rejected for the 
reasons set forth for the claims 6, 7, 8 and 9. 

7. Claims 36-43 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Lin et al. (hereinafter Lin)(US 6,751 , 668) in view of Primeaux et al. 
(hereinafter Primeaux) (US 6,334,121). as applied to claims above, and further 
in view of Prabandham et al. (hereinafter Prabandham)(US 6,701,438). 
Referring to claim 36, 

The reference Lin teaches a first receiving interface capable of accepting a HTTP 
request received from a subscriber using a first communication network., said 
request including a Universal Resource Locator (URL);(Fig. 1, element 106); a 
profile request generator capable of generating a profile request based upon said 
request; (col .2, lines 63-66); a filter capable of determining whether said request 
is authorized based upon said requested profile, said filter including; an updater 
to update a client HTTP request count when said request for said URL is a HTTP 
"GET" request or a HTTP "POST" request', and 

a responder to apply HTTP server denial of service attack preventative measures 
when a client HTTP request frequency based on said client HTTP request count 
exceeds a maximum HTTP request frequency; (col .2, lines 26-66, col .4, lines 14- 
18). Keeping in mind the teachings of the references Lin and Primeaux, both of 
these references fails to a first forwarding interface capable of sending said 
profile request to an Authentication, Authorization, and Accounting (AAA) server; 
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a second receiving interface capable of accepting a requested profile; an 
authorizer capable of allowing said request to be forwarding on at least one other 
communication network coupled to said first communication network: and a 
second forwarding interface capable of forwarding said request on said at least 
one other communication network. The reference Prabandham teaches an 
authorizer capable of allowing said request said request to be forwarded on at 
least one other communication network coupled to said first communication 
network. (Fig. 2, element 216 and col.4, line 67 and col. 5, lines 1-8); a first 
forwarding interface capable of sending said profile request to an AAA server; 
(element 212 which has the first receiving interface which is AAA server); a 
second receiving inter-face capable of accepting a requested profile; and a 
second forwarding interface capable of forwarding said request on said at least 
one other communication network, (element 216's interfaces connected to 
element 212 and element 206). Therefore, it would have been obvious to one 
having ordinary skill in the art at the time of invention was made to combine Lin 
with Primeaux's usage pattern tracking capabilities and Prabandham's security 
protocols. In this way, it will provide an alternative to the Lin's system for an user 
AAA verification, in addition to filter's capability to selectively passing some of the 
session establishment requests. 
Referring to claims 37 and 38, 

Claims 37 and 38 are rejected for the reasons set forth for the claims 3 and 4. 
Referring to claim 39, 
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The reference Lin teaches the method wherein the responder drops the data 
packet containing said request when said client HTTO request frequency 
exceeds said maximum HTTP request frequency. (coL2, lines 33-39, lines 63- 
66). 

Referring to claims 40, 41, 42 and 43, 

Claims 40, 41 , 42 and 43 are rejected for the reasons set forth for the claims 
6,7,8 and 9. 

Conclusion 

Examiner's note: Examiner has cited particular columns and line numbers in the 
references as applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings of the art and 
are applied to the specific limitations within the individual claim, other passages 
and figures may apply as well. It is respectfully requested from the applicant in 
preparing responses, to fully consider the references in entirety as potentially 
teaching all or part of the claimed invention, as well as the context of the passage 
as taught by the prior art or disclosed by the Examiner. 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of 
time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire 
THREE MONTHS from the mailing date of this action. In the event a first reply is 
filed within TWO MONTHS of the mailing date of this final action and the advisory 
action is not mailed until after the end of the THREE-MONTH shortened statutory 
period, then the shortened statutory period will expire on the date the advisory 
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action is mailed, and any extension fee pursuant to 37 CFR 1 .136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will 
the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Ashok B. Patel whose telephone number is 
(571) 272-3972. The examiner can normally be reached on 8:00am-5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, John A. Follansbee can be reached on (571) 272-3964. 
The fax phone number for the organization where this application or proceeding 
is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). /I 
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